High-Capacity Robust Medical Image Exfiltration via Neural Network Weight Replacement

2026-09-22

AI Summary

This study addresses the vulnerability of medical AI collaboration, wherein model weights can serve as covert carriers for sensitive imaging data leakage. To this end, this work proposes a high-capacity neural steganographic attack that transcends conventional bit-level limitations. Specifically, it leverages a StyleGAN2-based adversarial autoencoder to encode medical images into continuous latent representations, which are subsequently embedded into model initialization weights via noise-injection training and statistical consistency regularization to facilitate covert data exfiltration. This approach substantially enhances storage capacity and robustness against weight-cleansing defenses. Experimental results demonstrate that a 30MB model can successfully encapsulate 99 brain MRI volumes, enabling faithful anatomical reconstruction even after various defensive interventions, while further validating cross-modal effectiveness.

Abstract

Collaborative medical AI platforms allow researchers to train models on sensitive imaging data while restricting data export. However, trained models can serve as covert carriers of patient information: medical images may be encoded within model parameters and reconstructed outside the secure environment. Existing defenses rely on lightweight sanitization (e.g., fine-tuning, pruning, quantization) and limited statistical auditing, creating a realistic insider exfiltration risk. We introduce a high-capacity neural steganography attack that encodes medical images as continuous latent representations embedded into model initialization. A StyleGAN2-based adversarial autoencoder learns compact latent codes regularized to match standard weight initialization statistics, keeping embedded parameters statistically consistent with clean models. Noise injection during training improves robustness to export-time mitigation. The carrier model remains functional on its intended task and hidden images can be reconstructed directly from its weights after export. This continuous encoding enables robust and scalable exfiltration, allowing up to 99 brain MRI volumes to be embedded within a 30MB model, and remains recoverable under mitigations that disrupt prior bit-level schemes. While reconstructions are approximate rather than pixel-exact, embedded content remains anatomically recognizable and recoverable at scale, exposing a privacy risk distinct from prior bit-level approaches. Experiments on MIMIC-CXR, BraTS, and LiTS demonstrate effectiveness across modalities, tasks, and architectures, highlighting the need for structural defenses beyond parameter-level sanitization. Code is available at https://github.com/ElieThellier/high-capacity-robust-medical-image-exfiltration.

Problem

• medical image exfiltration
• neural steganography
• privacy risk
• model parameters
• collaborative AI

Innovation

• Neural Steganography
• Medical Image Exfiltration
• Continuous Latent Encoding
• Adversarial Autoencoder
• Weight Initialization